Description
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| contao | contao | >= 5.0.0, < 5.3.38, >= 5.4.0-RC1, < 5.6.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | contao/contao | >= 5.0.0, < 5.3.38 | 5.3.38 | GHSA-7m47-r75r-cx8v |
| Packagist | contao/contao | >= 5.4.0-RC1, < 5.6.1 | 5.6.1 | GHSA-7m47-r75r-cx8v |
| Packagist | contao/core-bundle | >= 5.0.0, < 5.3.38 | 5.3.38 | GHSA-7m47-r75r-cx8v |
| Packagist | contao/core-bundle | >= 5.4.0-RC1, < 5.6.1 | 5.6.1 | GHSA-7m47-r75r-cx8v |
Advisories 1
- WID-SEC-2025-1920 Contao: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 28, 2025